admin
7941b0c159
The row carried 'KNOWN, not MEASURED' because the throttle was still in force. It cleared 40 minutes later and the check was run: docker pull from Hub answered 'Image is up to date' for both bases - Hub's own manifest resolved to the images already local, the ones v0.233.0 was built from - and the manifest bodies are identical between registries. This matters for the row's own decision: the mirror being a sound source is what makes 'sanction the mirror in build.sh' a real option next to 'get a Docker Hub login', rather than a hope.
4.8 KiB
REPORT — update arc slices 1 & 2: documents, register, roadmap, capability map (2026-09-02)
Overwritten each session. Nothing durable lives only here.
What this session changed in THIS repo
| file | change |
|---|---|
documentation/architecture/09-update-architecture.md |
CREATED — the deliverable. Its absence was R-438. A LIVING document: every slice of this arc updates it in the same session. |
documentation/tests/VALIDATION-update-slice12-2026-09-02.md |
CREATED — the live evidence, copied off demo-hp at the end of the phase that produced it. |
documentation/backlog/OPEN-ITEMS.md |
R-438 and R-440 amended (both stay OPEN); 8 new rows: R-446..R-453. |
documentation/backlog/ROADMAP.md |
the update arc added as one item, naming the capability-map rows it flips. |
documentation/architecture/00-capability-map.md |
one new row: what version a box runs, and whether it is behind. |
STATUS.md |
one new operator item (9) and a new lead paragraph. |
The architecture document — what it settles
- How an update works today, as measured —
UpdateStackispullthenup -d --remove-orphans; the syncer overwrites a deployed app's compose on a 15-minute cycle with no deployed check; thirteen non-API call sites end incompose up -d. - What was chosen, and by whom —
RestartStack's own comment, quoted. A design decision is not a defect. What was never decided is what the syncer does underneath a deployed app. - The three operator rulings of 2026-09-02 — verified backup as a precondition; the support window runs on how far behind the CATALOG a box is; automatic within a major, never across one.
- The vocabulary ruling — "rollback" is struck. The available shapes are ABORT and RESTORE.
- The target shape — the live compose file becomes derived from a pin in
app.yaml. - The seven slices, each with a status line. 1 and 2 are shipped.
- Known limitations, including the floating-tag one.
Register
194 rows before, 205 after. Nothing closed, and that is stated rather than implied: R-438 and
R-440 are amended and stay OPEN — the mechanism is now documented, not changed — so nothing moved
to CLOSED-ITEMS.md and that file is untouched.
| row | what | state |
|---|---|---|
| R-446 | „Naprakész" can be FALSE for the 23 floating pins | OPEN, P2-MEDIUM, CC |
| R-447 | slice 3 — make the live compose DERIVED | BLOCKED on an operator ruling, P1-HIGH |
| R-448 | slice 4 — a guarded update (subsumes R-443) | READY, P2-MEDIUM |
| R-449 | slice 5 — an upgrade test that runs again | READY, P2-MEDIUM |
| R-450 | slice 6 — version sequence; an engine change gets its own edge | READY, P2-MEDIUM |
| R-451 | slice 7 — a fleet sweep (needs a hub change: no image field is reported) | READY, P3-LOW |
| R-452 | no gate enforces catalog_since (--depth 1 has no parent to diff) |
READY, P3-LOW |
| R-453 | CORRECTED — the password was fine; ~/.config/credentials uses SINGLE quotes and the strip was half-applied. The finding is the instrumentation lesson, not the typo |
READY, P3-LOW |
| R-454 | five gofmt-unclean internal/web test files, and no gate notices |
READY, P3-LOW |
| R-455 | DooPlex has no Docker Hub login — the ceiling now blocks BUILDS, not just gates. The mirror workaround is MEASURED byte-identical to Hub, so it is a sound fallback, not a hope | WAITING-ON-OPERATOR, P2-MEDIUM |
| R-456 | a partly-dead stack is not a boot orphan, and that rule is written down nowhere | READY, P3-LOW |
Live validation
Full evidence: documentation/tests/VALIDATION-update-slice12-2026-09-02.md.
PROVEN LIVE on demo-hp at controller 0.233.0, through a real production caller (the boot
reconciler — no hand-set state): bentopdf recorded 1 service, bookstack recorded 2, keyed by
compose service name, all three digests matching ground truth read independently beforehand.
Encrypted secrets byte-identical across the write. Both apps up and healthy; nothing provisioned.
The badge is ALSO proven live, on both surfaces and in three of its four states — including the
load-bearing one: a deployed app with no record renders no badge at all. „Frissítés elérhető —
52 napja" was produced by editing bentopdf's compose tag only (no restart, no up -d) and reverted
byte-identically. One correction of my own is stated in §4.0 of the validation file rather than
buried: I first reported the vaulted password as stale on both boxes. It was not — I stripped only
double quotes from a single-quoted value. The operator caught it in one line.
Sibling repos
felhom-controllerv0.233.0 —8025304acc0a, deployed to demo-hp and verified healthy.app-catalog-felhom.eu—69761cf91bfc(backfill) +8220f8d(REPORT).